Privacy policy.

We collect information you provide directly to us, information collected automatically when you use our Services, and information from third parties.

1.1 Information You Provide Directly

• Account Information: Name, email address, password, and organizational affiliation.
• Payment Information: Credit card details and billing addresses (processed securely by third-party processors like Stripe; we do not store full credit card numbers).
• Communications: Records of your support requests, feedback, and correspondence with us.

1.2 Information Collected Automatically (Visual & Spatial Data)

• Media Uploads: The raw photographs, videos, depth maps, and point clouds you upload to the Twinbly engine.
• Geospatial Metadata: We automatically extract EXIF data, including precise GPS coordinates, altitude, and timestamps. This is strictly required to place “Twinblies” accurately within the spatial coordinate system (Legend Guide).
• Device & Hardware Intelligence: We collect device identifiers, operating system versions, browser types, and hardware specifications (e.g., GPU capabilities, available RAM). Why we collect this: iOS and mobile browsers have strict memory limits. The Twinbly engine uses this data to dynamically adjust the Level of Detail (LOD) and prevent your device from crashing (the Safari “Jetsam” event) while viewing heavy 3D files.
• Telemetry and Interaction Data: We track how you interact with 3D models, including dwell time, camera rotation patterns, zoom levels, and click-through rates on spatial hotspots.

We use the information we collect for the following purposes:

• Service Delivery: To ingest, process, compress, and host your spatial data into interactive 3D Gaussian Splats.
• Mapping and Ecosystem Growth: To populate the Legend Guide global spatial index with Public Content.
• Algorithmic Improvement: To train our systems to better recognize lighting, geometry, and optimization pathways for faster web rendering.
• Security & Fraud Prevention: To verify accounts and monitor for suspicious or unauthorized activity.
• Communications: To send administrative notices, billing alerts, and marketing communications (which you can opt out of).

• Public Discovery (User Controlled): If you designate a model as “Public,” the 3D asset, its location metadata, and any associated hotspot information will be publicly accessible, crawlable by search engines, and integrated into our spatial maps.
• Service Providers: We share information with trusted third-party vendors who perform services on our behalf, such as cloud hosting (e.g., Google Cloud, AWS), payment processing, and analytics. These providers are contractually bound to protect your data.
• Legal Compliance & Safety: We may disclose your data if we believe disclosure is in accordance with, or required by, any applicable law, regulation, legal process (e.g., subpoena), or governmental request.
• Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction.

• The Privacy Toggle: You have control over the visibility of your assets. You may switch a model from “Public” to “Private” within your dashboard at any time. Upon switching to Private, the model will be removed from public directories and APIs within 24–48 hours.
• AI Training Opt-Out: Public Content is eligible to be used for training and improving our spatial AI models by default. You may opt out of this specific use at any time via the “Exclude from AI training” toggle in your account settings. See Terms §4.4(c) for details.
• Account Deletion: You may request account deletion at any time. Your raw uploads and attributed profile will be permanently deleted from our active systems within 30 days of your request. De-identified derivative data already incorporated into Aggregated Works (anonymized spatial index layers in the Legend Guide) may persist in that de-identified form, as outlined in Terms §4.5. EU/UK residents may request full erasure including from derivative works — see §7.2 below.
• Opt-Out of Marketing: You may opt out of promotional emails by following the unsubscribe link provided in those communications.

We implement commercially reasonable technical, administrative, and physical security measures designed to protect your information from unauthorized access, loss, or misuse. However, no data transmission over the Internet or cloud storage system can be guaranteed to be 100% secure. We retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements.

7.1 California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have the right to request access to the specific pieces of personal information we have collected about you, request deletion of your data, and opt out of the “sale” or “sharing” of your personal information.

Twinbly does not “sell” your personal information for monetary value. However, because Public Content may be incorporated into Aggregated Works such as the Legend Guide spatial index, this activity may be considered “sharing” under California law. You can opt out of this sharing by (a) setting affected models to Private, or (b) emailing legal@rockgarden.io with the subject line “Do Not Share My Information.”

7.2 European Economic Area (GDPR) and UK

If you are located in the EEA, UK, or Switzerland, we process your personal data under valid legal bases: performance of a contract (account operation), legitimate interests (service improvement, security, spatial integration into the Legend Guide), and consent (AI training opt-in where applicable).

You have the right to:

• Access the personal data we hold about you
• Request correction or erasure of your data, including from derivative works
• Restrict or object to our processing
• Request portability of your data in a machine-readable format
• Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)
• Lodge a complaint with your local supervisory authority

To exercise any of these rights, contact us at legal@rockgarden.io. We will respond within 30 days.

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information.